This Privacy Policy explains how Xora LLC, a Utah limited liability company ("Xora," "we," "us"), collects, uses, discloses, and protects information in connection with our website and the Xora software-as-a-service cybersecurity products (together, the "Services").
This Policy describes our handling of personal information. It does not cover Customer Data (scan targets, findings, and related content submitted to the Services), which is addressed separately in Section 7 of our Terms of Service.
1. Information We Collect
1.1 Information You Provide
When you create an account, request a demo, contact us, or otherwise interact with us, you may provide information such as your name, work email address, company name, job title, and any message content you send us. If you purchase paid Services, our payment processor collects billing information necessary to process the transaction.
1.2 Information Collected Automatically
When you visit our website or use the Services, we automatically collect certain information, including your IP address, browser and device type, operating system, pages viewed, referring URLs, and the dates and times of your visits ("Usage Data"). We collect this information through server logs and cookies and similar tracking technologies, described in Section 4 below.
1.3 Information From Third Parties
We may receive information about you from third parties, such as identity providers when you sign in with a single sign-on provider, or business contact and firmographic data from sales and marketing partners.
2. How We Use Information
We use the information we collect to:
(a) provide, operate, maintain, and improve the Services;
(b) create and manage your account, and communicate with you about the Services, including security notices and support requests;
(c) process payments and manage billing;
(d) respond to inquiries and provide customer support;
(e) send product updates, marketing communications, and other information we think may interest you, where permitted by law and subject to your opt-out preferences;
(f) monitor and analyze usage and trends to improve the website and the Services;
(g) detect, investigate, and prevent fraudulent, unauthorized, or illegal activity, and protect the security of the Services; and
(h) comply with legal obligations and enforce our agreements.
3. How We Share Information
We do not sell your personal information. We share information only as described below:
Service providers. We share information with vendors who perform services on our behalf, such as hosting, analytics, payment processing, customer support, and email delivery, under contractual obligations to protect that information and use it only to provide services to us.
Business transfers. If we are involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to standard confidentiality protections.
Legal requirements. We may disclose information if required to do so by law, subpoena, or other legal process, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
With your consent. We may share information for any other purpose with your consent.
Aggregated and de-identified data. We may share information that has been aggregated or de-identified such that it no longer identifies you.
4. Cookies and Analytics
We use cookies and similar technologies to operate and secure our website, remember your preferences, and understand how visitors use our website. We use analytics tools to help us understand website traffic and usage patterns. Most browsers let you refuse or delete cookies through their settings; doing so may affect the functionality of our website.
5. Data Security
We maintain administrative, technical, and physical safeguards designed to protect information from unauthorized access, disclosure, alteration, and destruction, including encryption in transit and at rest, access controls, and monitoring. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
6. Data Retention
We retain personal information for as long as needed to provide the Services, comply with our legal obligations, resolve disputes, and enforce our agreements. When information is no longer needed for these purposes, we delete or anonymize it.
7. International Data Transfers
We are based in the United States, and information we collect may be transferred to, stored, and processed in the United States or other countries where we or our service providers operate. Where required by applicable law, we take steps to ensure such transfers are subject to appropriate safeguards.
8. Your Rights and Choices
Depending on your location, you may have rights regarding your personal information, such as the right to access, correct, delete, or receive a copy of your information, and to object to or restrict certain processing. To exercise any of these rights, contact us using the information in Section 11 below. We will respond to verifiable requests as required by applicable law.
You may opt out of marketing emails at any time by using the unsubscribe link included in those emails. You may still receive transactional or administrative communications related to your account.
9. Children's Privacy
The Services are intended for business use and are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will take appropriate steps to delete it.
10. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will provide notice (via email or in-product notice) or update the "Last updated" date above. Your continued use of the Services after a change takes effect constitutes acceptance of the updated Policy.
11. Contact Us
If you have questions about this Privacy Policy or our data practices, contact us at legal@getxora.ai.